Privacy Policy

StandBased Ltd ("StandBased", "we", "us", "our") is a company registered in England and Wales under company number 17361238, with its registered office at 4 Dorchester Drive, Muxton, Telford, Shropshire, TF2 8SR. We are registered with the Information Commissioner's Office (ICO) under registration number [ICO REGISTRATION NUMBER].

We take the personal data in our care seriously. A great deal of it does not belong to us at all — it belongs to the football clubs we work with, and to their supporters. This policy explains exactly which is which.

It covers standbased.com, the StandBased platform (club apps, club websites, Dashboard, CRM, Shop, Memberships, Ticketing, Bookings, Food & Beverage, Loyalty, Youth, eMarketing, Social and Streaming) and the emails we send. It is written to meet the UK General Data Protection Regulation (UK GDPR) as amended by the Data (Use and Access) Act 2025, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

1. The two roles we play

This is the most important section of this policy, because the answer to "who is responsible for my data?" depends entirely on who you are.

Under data protection law there are two distinct roles. A controller decides why and how personal data is used. A processor handles personal data on a controller's instructions and may not use it for its own purposes. StandBased is a controller for some data and a processor for a great deal more.

Whose personal data	Our role	Who is the controller
Visitors to standbased.com	Controller	StandBased Ltd
People who contact us or request a quote	Controller	StandBased Ltd
Club staff and administrators who hold a StandBased account	Controller (for their account, security and support) and Processor (for what they do inside the club's data)	StandBased Ltd / the Club
Our own suppliers and business contacts	Controller	StandBased Ltd
Supporters, members, customers, ticket holders, youth players and their parents or guardians	Processor	The Club

1.1 What this means if you are a supporter

When a football club licenses StandBased, the club decides what to collect from its supporters, why, and for how long. The club is the data controller and its own privacy notice governs that data. StandBased is the processor: we build and run the software that holds it.

As a processor, we act only on the club's documented instructions, under a written contract that meets Article 28 of the UK GDPR. In practice that means:

• We do not use supporter data for our own purposes.
• We do not sell personal data, and we never have.
• We do not market our own products to a club's supporters.
• We do not pool or share one club's supporter data with another club. Each club's data is logically separated and accessible only to that club's authorised staff.
• We delete or return the club's data at the end of the contract, in line with the Club Terms.

If you are a supporter and you want to see, correct or delete your data, contact your club first — they hold the decision. If you contact us instead we will not ignore you: we will pass your request to the club without undue delay and support them in answering it.

2. Personal data we hold as a controller

This is the data we decide the use of ourselves. It is overwhelmingly business-to-business: the people at clubs who buy, run and support the platform.

Category	What it includes	Why we hold it	Lawful basis
Enquiries and quote requests	Name, email address, telephone number, job title, club name, the products you selected, how you heard about us and any referral code, the page you submitted from, and your browser user agent	To answer you, prepare and send a quote, and follow up on the opportunity	Steps taken at your request prior to entering a contract; legitimate interests (responding to a business enquiry)
Club relationship records	Contact details and job role of the people we deal with at a club, correspondence, meeting and call notes, quote and contract history, account status	To manage the commercial relationship and support the account	Performance of a contract; legitimate interests (managing our customer relationships)
Platform accounts for club staff	Name, work email address, role and permission level, sign-in identifiers, password hashes, two-factor settings, login and activity logs, IP address	To create and secure accounts, apply role-based permissions, provide support, and investigate misuse	Performance of a contract; legitimate interests (security and fraud prevention); legal obligation
Marketing contacts	Name, business email address, club or organisation, subscription topics, consent and opt-out records, and email engagement events (delivery, opens, clicks, bounces, complaints)	To send product news, guidance, webinar and event invitations to clubs and prospective clubs	Consent, or legitimate interests where PECR permits business-to-business electronic mail — see section 5
Website and analytics data	Pages viewed, referring source, approximate location derived from IP address, device and browser type, and interaction events	To understand how the site is used, measure our marketing and keep the site fast and secure	Consent for analytics cookies; legitimate interests for security and fraud prevention
Suppliers and business contacts	Name, business contact details, and payment or invoicing details	To buy in services and meet our accounting obligations	Performance of a contract; legal obligation
Correspondence	Emails, form messages, support tickets and anything else you choose to send us	To handle the matter you raised and keep a record of it	Legitimate interests (running our business and keeping proper records)

3. Personal data we process on behalf of clubs

The following is data we hold as a processor. The club that licenses the relevant product decides what is collected and why; the list below sets out the types of data the platform is capable of holding, so that supporters and clubs alike can see the full picture. A club that has not licensed a product does not hold the data associated with it.

Product	Types of personal data held
Club app and club website accounts	Name, email address, telephone number, postal address, date of birth, profile photograph where supplied, sign-in identifiers (including email and password, or Google, Apple or Facebook sign-in), device identifiers, push notification tokens, notification and content preferences, and app usage events
CRM	A consolidated supporter record drawing on the products below: contact details, supporter type, tags and segments, interaction and purchase history, engagement scores and reporting
Shop and Memberships	Order and basket history, item and size details, delivery and billing addresses, membership type, renewal dates, season ticket and donation records. Card details are entered directly into our payment provider and are never stored by StandBased
Ticketing and Bookings	Booking and ticket records, attendance history, facility hire enquiries and confirmations, party sizes, access requirements where the supporter supplies them, and payment status
Food & Beverage (ePOS)	Transaction records, items purchased, order and table references, receipt details, and the linked supporter or loyalty account where one is used
Loyalty	Points balances, earning and redemption history, tier or reward status, and the purchasing behaviour that generates them
eMarketing	Email address, name, subscription topics, consent and opt-out records with their date and source, and per-message engagement events (sent, delivered, opened, clicked, bounced, marked as spam, unsubscribed)
Youth	Player name, date of birth and age group, team and squad allocation, parent or guardian names and contact details, emergency contacts and medical information, consents and permissions supplied by a parent or guardian, kit sizes and orders, attendance at training and fixtures, and fees, fines and instalment payment records — see section 4
Streaming	Entitlement and access records, and viewing history for the club's own content
Social	Content scheduled and published by the club, and the engagement data returned by the social networks. Personal data here is generally that of the club's own staff and of members of the public who interact publicly with the club's accounts

We also generate technical data in the ordinary course of running the platform — application and access logs, error reports, and backups — which may contain personal data incidentally.

4. Children's data and special category data

Two categories of data on the platform need particular care, and both arise chiefly through StandBased Youth.

4.1 Special category data

Medical information about a young player — allergies, conditions, medication and similar — is "special category data" under Article 9 of the UK GDPR and attracts a higher standard of protection. Where a club uses StandBased Youth, that information is collected by the club, on the club's lawful basis and with the explicit consent or other Article 9 condition the club has obtained from the parent or guardian. StandBased holds it only as a processor, on the club's instruction. Access is restricted to the club staff the club itself authorises, and it is never used for analytics, marketing, profiling or product development.

4.2 Children

Parts of the platform are likely to be accessed by people under 18. We design them in line with the ICO's Age Appropriate Design Code (the Children's Code). In particular:

• Registration of a young player is completed by a parent or guardian, and the parent or guardian is the point of contact for consents, permissions and communications.
• We apply data minimisation and high-privacy defaults: nothing beyond what the club needs to run its youth section, and no unnecessary sharing.
• We do not profile children for marketing, do not use their data to build advertising audiences, and do not use nudge techniques to encourage children to give up more data.
• Marketing communications relating to a young player are addressed to the parent or guardian, not the child.
• We carry out a Data Protection Impact Assessment for processing that is likely to result in high risk, including processing children's and medical data, and we make it available to clubs on request.

If you are a parent or guardian and you have a concern about your child's data, contact the club in the first instance, or us at hello@standbased.com, and we will help.

5. Email, marketing and how to unsubscribe

Email is central to what the platform does, so it is worth being precise about it. There are two very different kinds of email in play.

5.1 Emails StandBased sends on its own behalf

These go to club staff, prospective clubs and people who have contacted us. They fall into two groups:

• Service emails — quotes, onboarding, invoices, support replies, security notices, planned maintenance and incident updates. These are part of providing the service. You cannot opt out of them while you hold an account or an open enquiry with us, because we need to be able to reach you about the service itself. They are not marketing.
• Marketing emails — product news, guidance, case studies, webinar and event invitations.

Our marketing email is business-to-business. PECR allows unsolicited marketing email to corporate subscribers, and where we rely on that we do so under our legitimate interests in promoting our services to football clubs. Where we email an individual subscriber, a sole trader or an unincorporated partnership, we rely on your consent, or on the "soft opt-in" where you are an existing customer, the marketing concerns similar StandBased products, and you were given the chance to refuse when we first collected your address.

Whichever basis applies, every marketing email we send carries a working unsubscribe link and a List-Unsubscribe header so your mail provider can offer its own one-click button. We act on an opt-out immediately, and in any event within 72 hours. You can also opt out at any time by emailing hello@standbased.com.

We measure whether our marketing emails are delivered, opened and clicked, so that we can tell what is useful and stop sending what is not.

5.2 Emails clubs send to their supporters

When a club emails its supporters through StandBased eMarketing, the club is the sender and the controller. The club is responsible for having a valid consent or soft opt-in for each recipient. We provide the sending infrastructure and the opt-out machinery.

We run a single preference centre for every club on the platform, at standbased.com/email/preferences/..., reached from the footer of any club marketing email. From there you can:

• See which topics you are subscribed to and turn any of them off individually;
• Unsubscribe from that club's marketing email entirely;
• See the club's postal address, as required by law.

Two design points are worth stating openly, because they protect you:

• Opening a preference link never changes anything. Corporate mail filters and link scanners follow every link in an email automatically. If simply loading the page unsubscribed people, scanners would silently opt out supporters who never clicked. Nothing changes until you press a button — with the single exception of one-click unsubscribe, which mail providers send as a form submission and is therefore safe from scanners by design.
• A complaint or a hard bounce suppresses you everywhere. If you mark a club's email as spam, or your address stops accepting mail, we suppress it across every club on the platform rather than only the one that sent it.

Unsubscribing from marketing does not stop essential service messages from a club, such as an order confirmation or a booking receipt.

5.3 Suppression lists

When you unsubscribe we keep a minimal record of your email address on a suppression list. This may look counter-intuitive, but it is the only reliable way to guarantee we do not email you again — deleting the record entirely would allow a later import to re-add you. We keep nothing on a suppression list beyond what is needed for that purpose.

6. Cookies, analytics and tracking

standbased.com uses cookies and similar technologies. Some are strictly necessary — they keep you signed in to the Dashboard, remember your preferences and protect the site from abuse. These do not require your consent.

Others are not strictly necessary and are used to measure how the site performs:

Technology	Provider	Purpose
Google Analytics 4	Google Ireland Ltd / Google LLC	Aggregate reporting on how visitors find and use the site
Metricool tracker	Metricool Software SL (Spain)	Measuring the performance of our social and content marketing
Cloudflare	Cloudflare, Inc.	Content delivery, performance and protection against attacks and bot traffic

None of these load until you allow them. We ask on your first visit, and nothing in the analytics or marketing categories runs unless you agree — refusing takes one click, in the same place and at the same size as accepting. You can change your mind at any time using the Cookie Preferences link in the footer of every page; withdrawing consent disables the tracker immediately and deletes the cookies it had already set.

Full detail on every individual cookie and storage key, and how long each lasts, is in our Cookies Policy.

Club apps and club websites built on StandBased may set their own cookies under the club's control; the club's own cookie notice covers those.

7. Who we share personal data with

We do not sell personal data, and we do not share it for anyone else's marketing.

We use a small number of carefully chosen service providers, each engaged under a written contract that requires them to process data only on our instructions and to keep it secure:

Provider	What they do for us	Where they process data
Cloudflare, Inc.	Hosting, content delivery, database and file storage, and network security for standbased.com and the platform	Global network; primarily UK and EEA, United States
Brevo (Sendinblue SAS)	Sending transactional and marketing email	European Union (France)
Stripe, Inc. / Stripe Payments Europe Ltd	Card payments for Shop, Memberships, Bookings and Food & Beverage. Stripe is a controller in its own right for payment data	Ireland, United States
Freshworks Inc.	Our own sales CRM — club contacts and enquiry records only, never supporter data	European Union, United States, India
Google Ireland Ltd	Website analytics	European Union, United States
Metricool Software SL	Marketing measurement	European Union (Spain)
Apple Inc. and Google LLC	Delivering push notifications to club app users, and app distribution	United States

We may also disclose personal data to our professional advisers (lawyers, accountants, insurers) where necessary; to a purchaser or successor if our business is sold or reorganised; and to a regulator, court or law enforcement body where we are legally required to do so or where it is necessary to establish, exercise or defend legal claims. Where we receive a request for data we will satisfy ourselves that it is lawful before responding.

8. Sending data outside the UK

Some of the providers above process data outside the United Kingdom, as noted in the table. Where that happens we make sure one of the following applies:

• The country is covered by UK adequacy regulations (this includes the EEA countries);
• The transfer is made under the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment;
• The recipient is certified under the UK Extension to the EU-US Data Privacy Framework.

You can ask us for a copy of the safeguards that apply to a particular transfer by emailing hello@standbased.com.

9. How long we keep personal data

We keep personal data only as long as we need it. Where we act as a processor, retention is set by the club and by our contract with them.

Data	Retention period
Enquiries and quote requests that do not become customers	24 months from the last contact
Club relationship and contract records	For the life of the contract and 6 years afterwards, to cover the limitation period for contractual claims
Financial and accounting records	6 years from the end of the financial year they relate to (Companies Act 2006 and HMRC requirements)
Platform accounts for club staff	For as long as the account is active, then deleted within 90 days of the account being closed
Marketing contacts	Until you unsubscribe, or after 24 months of no engagement, whichever is sooner
Suppression list entries	Indefinitely — this is the record that stops us contacting you again
Website analytics	14 months
Application, access and security logs	12 months
Backups	Up to 35 days, after which they are overwritten in rotation
Supporter and youth data held for a club	As instructed by the club. On termination, returned or deleted in line with the Club Terms

Where a deletion request is made, data removed from live systems may persist in backups until those backups rotate out. It is isolated from active use in the meantime.

10. How we keep personal data secure

We take appropriate technical and organisational measures to protect personal data, including:

• Encryption of data in transit using TLS, and encryption at rest on our infrastructure;
• Role-based access control, so club staff see only what their role requires, and least-privilege access for our own team;
• Two-factor authentication on administrative access, and secrets held in managed secret storage rather than in code;
• Logical separation of each club's data, so one club can never reach another's;
• Single-use, purpose-scoped tokens for sensitive links such as email preference pages, validated server-side before anything is disclosed;
• Regular backups, monitoring and logging;
• Contractual confidentiality and data protection obligations on everyone who works on the platform.

No system is perfectly secure. If a personal data breach occurs we will assess it without delay, notify the ICO within 72 hours where the breach is likely to result in a risk to people's rights and freedoms, notify affected individuals where the risk is high, and — where we are a processor — notify the affected club without undue delay so that they can meet their own obligations.

11. Your rights

Under UK data protection law you have the following rights. Some of them apply only in particular circumstances.

• To be informed — to know what we do with your data. That is what this policy is for.
• Of access — to receive a copy of the personal data we hold about you.
• To rectification — to have inaccurate data corrected and incomplete data completed.
• To erasure — to have your data deleted where we no longer have grounds to keep it.
• To restrict processing — to have us pause our use of your data, for example while its accuracy is being checked.
• To data portability — to receive data you gave us in a structured, commonly used, machine-readable form, and to have it sent to another provider where technically feasible.
• To object — to object to processing based on legitimate interests. Where you object to direct marketing, we will stop. There is no balancing test on that one and it is absolute.
• To withdraw consent — at any time, where we relied on consent. Withdrawing it does not affect what we did before you withdrew it.
• Not to be subject to solely automated decisions that produce legal or similarly significant effects — see section 12.

To exercise any of these, email hello@standbased.com with "Data protection request" in the subject line. It is free. We will respond within one month, and will tell you if we need to extend that by up to two further months because the request is complex — the law allows this, and we will explain why. We may ask you to confirm your identity before we disclose personal data, so that we do not hand it to the wrong person.

If you are a supporter of a club, please send your request to the club, which is the controller. If it reaches us we will forward it to the club promptly and help them answer it.

12. Automated decision-making and profiling

We do not make decisions about you by solely automated means that produce legal effects or similarly significantly affect you.

The platform does carry out profiling in the ordinary marketing sense: the CRM groups supporters into segments and audiences based on the data a club holds — for example, season ticket holders, recent shop customers, or supporters who have not attended for some time — so that a club can send more relevant communications. Those segments are defined and used by the club, not by us. You can object to this being used for direct marketing at any time, and the objection must be honoured. As set out in section 4, we do not profile children for marketing.

13. Complaints

If you are unhappy with how we have handled your personal data or a request you made, tell us first — it is usually the quickest way to put something right. Email hello@standbased.com with "Data protection complaint" in the subject line, setting out what happened.

We will acknowledge your complaint within 30 days of receiving it, and we will keep you informed of progress and tell you the outcome. Complaints are handled by our data protection contact and are logged and reviewed.

You also have the right to complain to the Information Commissioner's Office at any time, and using our complaints procedure first does not take that right away:

• Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
• Helpline: 0303 123 1113
• ico.org.uk/make-a-complaint

14. Links to other websites

standbased.com and club sites built on StandBased may link to websites we do not run — social networks, ticketing partners, league and governing body sites among them. We are not responsible for their content or their privacy practices, and we encourage you to read their privacy notices before giving them your data.

15. Changes to this policy

We review this policy at least annually and whenever we make a significant change to the platform, our providers or the law. The date it was last changed is shown at the top of this page.

Where a change materially affects how we use your personal data, we will bring it to your attention directly — by email to club contacts, or by a notice on the site — rather than relying on you to notice the date has moved. Historic versions are available on request.

16. How to contact us

For anything in this policy, including data protection requests and complaints:

• Email: hello@standbased.com
• Telephone: +44 7415 776364
• Post: Data Protection, StandBased Ltd, 4 Dorchester Drive, Muxton, Telford, Shropshire, TF2 8SR

We are not required to appoint a statutory Data Protection Officer and have not done so. Responsibility for data protection sits with our directors, and the address above reaches them.